CVE-2026-35308: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars)

Synopsis

A critical remote code execution class vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). It is reachable over the network via HTTP with no authentication required and no user interaction needed, and the CVSS scope is changed, meaning a successful attacker can break out of the vulnerable component and affect other systems. Exploitation results in full takeover of Oracle Coherence, with high impact to confidentiality, integrity, and availability. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Coherence service over the network via HTTP; no local or physical access is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required; the vulnerability is exposed to unauthenticated attackers.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no race conditions or special environmental factors to satisfy.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Coherence process, including cached application data, session tokens, and any secrets held in memory.
• The attacker can write or modify persisted data within Oracle Coherence, corrupting cache state or injecting malicious entries consumed by downstream services.
• The Coherence service can be crashed or rendered permanently unavailable, disrupting any application layer that depends on it for distributed caching or data management.
• Because the CVSS scope is changed, the attacker can pivot to compromise other products and services running in the same environment beyond Oracle Coherence itself.